Stickerify/.github/workflows/unit-test.yml at 115dd8115f71fe0326b33bde96beb81b230dced3 · Stickerifier/Stickerify · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
name: Unit tests CI

on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main

permissions: read-all

jobs:
  tests:
    name: Execute unit tests
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest, windows-latest, macos-13 ] # pin macos to latest x64 image
    steps:
      - name: Checkout code changes
        uses: actions/checkout@v5

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        if: runner.os == 'Linux'
        with:
          languages: "java"
          queries: security-and-quality

      - name: Setup FFmpeg
        uses: FedericoCarboni/setup-ffmpeg@v3
        with:
          # bump: ffmpeg-ci /ffmpeg-version: '([\d.]+)'/ docker:mwader/static-ffmpeg|~7.0
          ffmpeg-version: '7.0.2'

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 25

      - name: Setup project and upload dependency graph
        uses: gradle/actions/setup-gradle@v4
        with:
          dependency-graph: generate-and-submit
          build-scan-publish: true
          build-scan-terms-of-use-url: 'https://gradle.com/help/legal-terms-of-use'
          build-scan-terms-of-use-agree: 'yes'

      - name: Execute tests
        shell: bash
        run: ./gradlew test

      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        if: runner.os == 'Linux'
        with:
          name: coverage_report
          path: build/code-coverage/report.xml
          retention-days: 1
          if-no-files-found: error

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v3
        if: runner.os == 'Linux'
        with:
          upload: false
          output: build/sarif-results

      - name: Upload CodeQL report
        uses: actions/upload-artifact@v4
        if: runner.os == 'Linux'
        with:
          name: codeql_analysis
          path: build/sarif-results/java.sarif
          retention-days: 1
          if-no-files-found: error

  codeql:
    name: Upload CodeQL analysis
    needs: tests
    runs-on: ubuntu-latest
    permissions:
      checks: write
      security-events: write
    steps:
      - name: Checkout code changes
        uses: actions/checkout@v5
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0

      - name: Download coverage report
        uses: actions/download-artifact@v5
        with:
          name: codeql_analysis
          path: build/sarif-results

      - name: Filter SARIF
        uses: advanced-security/filter-sarif@v1
        if: runner.os == 'Linux'
        with:
          patterns: |
            -.gradle/**
            -**/generated/**
          input: build/sarif-results/java.sarif
          output: build/sarif-results/java.sarif

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: build/sarif-results/java.sarif
          category: "/language:java"

  qodana:
    name: Perform Qodana analysis
    if: ${{ vars.QODANA_ENABLED == 'true' }}
    needs: tests
    runs-on: ubuntu-latest
    permissions:
      checks: write
      security-events: write
    steps:
      - name: Checkout code changes
        uses: actions/checkout@v5
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0

      - name: Download coverage report
        uses: actions/download-artifact@v5
        with:
          name: coverage_report
          path: .qodana/code-coverage

      - name: Execute analysis
        uses: JetBrains/qodana-action@v2025.2
        env:
          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
        with:
          args: '--baseline,qodana.baseline.json'
          use-caches: false
          post-pr-comment: false
          pr-mode: false

      - name: Upload results to GitHub
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ runner.temp }}/qodana/results/qodana.sarif.json